Analysis Report

Overview

General Information

Joe Sandbox Version:	21.0.0
Analysis ID:	485992
Start time:	16:18:02
Joe Sandbox Product:	Cloud
Start date:	22.01.2018
Overall analysis duration:	0h 13m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Xtaqxu6frQ (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled GSI enabled (VBA) GSI enabled (Javascript)
Detection:	MAL
Classification:	mal84.evad.spre.adwa.phis.spyw.troj.winEXE@25/41@29/1
HCA Information:	Successful, ratio: 99% Number of executed functions: 60 Number of non-executed functions: 68
EGA Information:	Successful, ratio: 100%
Warnings:	Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, conhost.exe, WMIADAP.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteVirtualMemory calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: fero.exe, chrome64x.exe, chrome64x.exe, chrome64x.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	84	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Signature Overview

Click to jump to signature section

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to capture screen (.Net source)

Show sources

Source: 4.2.fero.exe.680000.1.raw.unpack, OK.cs	.Net Code: Ind
Source: 8.2.chrome64x.exe.6a0000.1.raw.unpack, OK.cs	.Net Code: Ind
Source: 16.2.chrome64x.exe.550000.1.raw.unpack, OK.cs	.Net Code: Ind
Source: 18.2.chrome64x.exe.3b0000.1.raw.unpack, OK.cs	.Net Code: Ind

Networking:

Found strings which match to known social media urls

Show sources

Source: fero.exe	String found in binary or memory: Microsoft.AspNet.Mvc.Facebook.V+ equals www.facebook.com (Facebook)
Source: AcroRd32.exe	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: AcroRd32.exe	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: AcroRd32.exe	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: fero2003.ddns.net

Urls found in memory or binary data

Show sources

Source: fero.exe	String found in binary or memory: file:///C:/Users/user/AppData/Local/Temp/chrome64x.exe
Source: fero.exe	String found in binary or memory: file:///C:/Users/user/Desktop/
Source: fero.exe	String found in binary or memory: file:///C:/Users/user/Desktop/fed
Source: fero.exe	String found in binary or memory: file:///C:/Users/user/Desktop/fero.exe
Source: fero.exe	String found in binary or memory: file:///C:/Users/user/Desktop/fero.exeindY
Source: AcroRd32.exe	String found in binary or memory: file://AcrobatMedia003118
Source: AcroRd32.exe	String found in binary or memory: file://AcrobatMedia003118/c/0
Source: AcroRd32.exe	String found in binary or memory: file://AcrobatMedia003118/c/0Vector.
Source: AcroRd32.exe	String found in binary or memory: file://AcrobatMedia003118/c/0file://AcrobatMedia003118/c/0file://AcrobatMedia003118/c/0
Source: AcroRd32.exe	String found in binary or memory: file://AcrobatMedia003118/c/0xi
Source: AcroRd32.exe	String found in binary or memory: http://
Source: AcroRd32.exe	String found in binary or memory: http://.acrocomcontent.com
Source: AcroRd32.exe	String found in binary or memory: http://altright.com
Source: fire and fury.pdf	String found in binary or memory: http://altright.com)
Source: AcroRd32.exe	String found in binary or memory: http://cacerts.di
Source: AcroRd32.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: fire and fury.pdf	String found in binary or memory: http://calibre-ebook.com
Source: fire and fury.pdf	String found in binary or memory: http://calibre-ebook.com/xmp-namespace
Source: fire and fury.pdf	String found in binary or memory: http://calibre-ebook.com/xmp-namespace-custom-columns
Source: fire and fury.pdf	String found in binary or memory: http://calibre-ebook.com/xmp-namespace-series-index
Source: AcroRd32.exe	String found in binary or memory: http://calibre-ebook.com/xmp-namespace6p
Source: AcroRd32.exe	String found in binary or memory: http://calibre-ebook.com/xmp-namespace=p
Source: AcroRd32.exe	String found in binary or memory: http://calibre-ebook.com/xmp-namespaceic/2.0/
Source: AcroRd32.exe	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: AcroRd32.exe	String found in binary or memory: http://cipa.jp/exif/1.0/KN1
Source: AcroRd32.exe	String found in binary or memory: http://cipa.jp/exif/1.0/dN1
Source: AcroRd32.exe	String found in binary or memory: http://crl.comodo.net/UTN-USERFirst-Hardware.crl0q
Source: AcroRd32.exe	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: AcroRd32.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: AcroRd32.exe	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: AcroRd32.exe	String found in binary or memory: http://crl.geotrust.com/crls/gtglobal.crl04
Source: AcroRd32.exe	String found in binary or memory: http://crl.m
Source: AcroRd32.exe	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: AcroRd32.exe	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: AcroRd32.exe	String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
Source: AcroRd32.exe	String found in binary or memory: http://crl.veris
Source: AcroRd32.exe	String found in binary or memory: http://crl3.digicert.c
Source: AcroRd32.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: AcroRd32.exe	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: AcroRd32.exe	String found in binary or memory: http://crl4.E
Source: AcroRd32.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: AcroRd32.exe	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: AcroRd32.exe	String found in binary or memory: http://crt.comodoca.com/UTNAddTrustServerCA.crt0$
Source: AcroRd32.exe	String found in binary or memory: http://cybertrust.omniroot.com/repository.cfm0
Source: AcroRd32.exe	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: AcroRd32.exe	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/m
Source: AcroRd32.exe	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/t
Source: AcroRd32.exe	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: AcroRd32.exe	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.comodoca.com0%
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.comodoca.com0-
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.comodoca.com0/
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.comodoca.com05
Source: 1E11E75149C17A93653DA7DC0B8CF53F_7AF31CAFD5EA10EF3F1F95E6796CFF64.2.dr	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOe
Source: 7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6.2.dr	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.digicert.com0F
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootCA.crlhttp://crl4.digicert.com/Di
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/ssca-sha2-g6.crlhttp://crl4.digicert.com/ssca-sha2-
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.entrust.net0D
Source: AcroRd32.exe	String found in binary or memory: http://ocsp.geotrust.com0K
Source: fire and fury.pdf	String found in binary or memory: http://prismstandard.org/namespaces/basic/2.0/
Source: AcroRd32.exe	String found in binary or memory: http://prismstandard.org/namespaces/basic/2.0/Ep
Source: AcroRd32.exe	String found in binary or memory: http://prismstandard.org/namespaces/basic/2.0/Lp
Source: AcroRd32.exe	String found in binary or memory: http://recentfiles
Source: AcroRd32.exe, UserCache.bin.6.dr	String found in binary or memory: http://recentfiles.
Source: AcroRd32.exe, UserCache.bin.6.dr	String found in binary or memory: http://recentfiles.com.adobe.acrobat.extensions.files_description
Source: AcroRd32.exe	String found in binary or memory: http://recentfilesH
Source: AcroRd32.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: AcroRd32.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: AcroRd32.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: AcroRd32.exe	String found in binary or memory: http://uri.etsi.org/01903/v1.1.1#
Source: AcroRd32.exe	String found in binary or memory: http://ww
Source: AcroRd32.exe	String found in binary or memory: http://www
Source: AcroRd32.exe	String found in binary or memory: http://www.a
Source: AcroRd32.exe	String found in binary or memory: http://www.adob
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#%
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#3
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#:
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/
Source: AcroRd32.exe	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/2L1
Source: AcroRd32.exe	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: AcroRd32.exe	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: AcroRd32.exe	String found in binary or memory: http://www.geotrust.com/resources/cps0(
Source: AcroRd32.exe	String found in binary or memory: http://www.hachette.co.uk
Source: fire and fury.pdf	String found in binary or memory: http://www.hachette.co.uk)
Source: AcroRd32.exe	String found in binary or memory: http://www.littlebrown.co.uk
Source: fire and fury.pdf	String found in binary or memory: http://www.littlebrown.co.uk)
Source: AcroRd32.exe	String found in binary or memory: http://www.macromedia.com
Source: AcroRd32.exe	String found in binary or memory: http://www.macromedia.comfile://AcrobatMedia003118/c/0file://AcrobatMedia003118
Source: AcroRd32.exe	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: AcroRd32.exe	String found in binary or memory: http://www.npes.org/pdfx/ns/id/~O1
Source: AcroRd32.exe	String found in binary or memory: http://www.public-trust.com/CPS/OmniRoot.html0
Source: AcroRd32.exe	String found in binary or memory: http://www.public-trust.com/cgi-bin/CRL/2018/cdp.crl0
Source: AcroRd32.exe	String found in binary or memory: http://www.usertrust.com1
Source: AcroRd32.exe	String found in binary or memory: https://
Source: AcroRd32.exe	String found in binary or memory: https://.acrocomcontent.com
Source: AcroRd32.exe	String found in binary or memory: https://QA
Source: AcroRd32.exe	String found in binary or memory: https://WebServiceJob/com.adobe.acrobat.ADotCom/Resource/
Source: AcroRd32.exe	String found in binary or memory: https://WebServiceJob/com.adobe.acrobat.ADotCom/Resource/api
Source: AcroRd32.exe	String found in binary or memory: https://WebServiceJob/com.adobe.acrobat.RFLMAP/Resource/
Source: AcroRd32.exe	String found in binary or memory: https://ims-na1.adobelogin.com
Source: AcroRd32.exe	String found in binary or memory: https://ims-na1.adobelogin.com/
Source: AcroRd32.exe	String found in binary or memory: https://secure.comodo.com/CPS0
Source: AcroRd32.exe	String found in binary or memory: https://w
Source: ReaderMessages-journal.6.dr	String found in binary or memory: https://www.acro
Source: AcroRd32.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: AcroRd32.exe	String found in binary or memory: https://www.macromedia.com/support/flashplayer/sys/
Source: AcroRd32.exe	String found in binary or memory: https://www.macromedia.com/support/flashplayer/sys/Q
Source: AcroRd32.exe	String found in binary or memory: https://www.macromedia.com/support/flashplayer/sys/broadcastMessage
Source: AcroRd32.exe	String found in binary or memory: https://www.macromedia.com/support/flashplayer/sys/xehttps://www.macromedia.com/support/flashplayer/

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.16:49194 -> 91.109.180.3:1177

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: fero2003.ddns.net

Boot Survival:

Creates an autostart registry key

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run f39b6b3505175465947b62295a9a0ae2
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run f39b6b3505175465947b62295a9a0ae2
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f39b6b3505175465947b62295a9a0ae2
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f39b6b3505175465947b62295a9a0ae2

Creates a start menu entry (Start Menu\Programs\Startup)

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f39b6b3505175465947b62295a9a0ae2.exe

Stores files to the Windows start menu directory

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f39b6b3505175465947b62295a9a0ae2.exe

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f39b6b3505175465947b62295a9a0ae2

Drops PE files to the startup folder

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f39b6b3505175465947b62295a9a0ae2.exe

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f39b6b3505175465947b62295a9a0ae2.exe
Source: C:\Users\user\Desktop\fero.exe	File created: C:\Users\user\AppData\Local\Temp\chrome64x.exe
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	File created: C:\Users\user\Desktop\fero.exe

Data Obfuscation:

Binary may include packed or encrypted code

Show sources

Source: initial sample	Static PE information: section name: .text entropy: 7.83582372484
Source: initial sample	Static PE information: section name: .text entropy: 7.83582372484

File is packed with WinRar

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_206875

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01391404 push eax; ret		1_2_01391422
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_013920D6 push ecx; ret		1_2_013920E9

.NET source code contains potential unpacker

Show sources

Source: 4.2.fero.exe.680000.1.raw.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.2.chrome64x.exe.6a0000.1.raw.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 16.2.chrome64x.exe.550000.1.raw.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.2.chrome64x.exe.3b0000.1.raw.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_0138ECFC SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,SetDlgItemTextW,FindClose,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,SetDlgItemTextW,SetDlgItemTextW,	1_2_0138ECFC
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_0139C562 FindFirstFileExA,	1_2_0139C562
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01382816 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_01382816

Contains functionality to spread to USB devices (.Net source)

Show sources

Source: 4.2.fero.exe.680000.1.raw.unpack, OK.cs	.Net Code: USBspr
Source: 8.2.chrome64x.exe.6a0000.1.raw.unpack, OK.cs	.Net Code: USBspr
Source: 16.2.chrome64x.exe.550000.1.raw.unpack, OK.cs	.Net Code: USBspr
Source: 18.2.chrome64x.exe.3b0000.1.raw.unpack, OK.cs	.Net Code: USBspr

May infect USB drives

Show sources

Source: fero.exe	Binary or memory string: autorun.inf![autorun]
Source: fero.exe	Binary or memory string: autorun.inf![autorun]

System Summary:

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Show sources

Source: C:\Users\user\Desktop\fero.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Submission file is bigger than most known malware samples

Show sources

Source: Xtaqxu6frQ.exe

Static file information: File size 1571773 > 1048576

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe

File opened: C:\Windows\system32\MSVCR100.dll

PE file contains a mix of data directories often seen in goodware

Show sources

Source: Xtaqxu6frQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Xtaqxu6frQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Xtaqxu6frQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Xtaqxu6frQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Xtaqxu6frQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Xtaqxu6frQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: Xtaqxu6frQ.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Show sources

Source: Xtaqxu6frQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Show sources

Source:	Binary string: c:\Users\verge\Documents\Visual Studio 2013\Projects\fero\fero\obj\Debug\fero.pdbh source: fero.exe
Source:	Binary string: c:\Users\verge\Documents\Visual Studio 2013\Projects\fero\fero\obj\Debug\fero.pdb source: fero.exe
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: Xtaqxu6frQ.exe

PE file contains a valid data directory to section mapping

Show sources

Source: Xtaqxu6frQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Xtaqxu6frQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Xtaqxu6frQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Xtaqxu6frQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Xtaqxu6frQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

.NET source code contains calls to encryption/decryption functions

Show sources

Source: chrome64x.exe.4.dr, Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: f39b6b3505175465947b62295a9a0ae2.exe.8.dr, Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Binary contains paths to development resources

Show sources

Source: Xtaqxu6frQ.exe

Binary or memory string: 3.vbP.v

Classification label

Show sources

Source: classification engine

Classification label: mal84.evad.spre.adwa.phis.spyw.troj.winEXE@25/41@29/1

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_206875

Creates temporary files

Show sources

Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\FAP3C6E.tmp

Launches a second explorer.exe instance

Show sources

Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe

PE file has an executable .text section and no other executable section

Show sources

Source: Xtaqxu6frQ.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Show sources

Source: C:\Users\user\Desktop\fero.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Reads ini files

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

File read: C:\Windows\win.ini

Reads software policies

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\Xtaqxu6frQ.exe 'C:\Users\user\Desktop\Xtaqxu6frQ.exe'
Source: unknown	Process created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\fire and fury.pdf'
Source: unknown	Process created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' /b /id 1480_3105 /if pdfshell_shedd541f9-0a3b-42a7-bd11-13068122ae87 --shell-broker-channel=broker_pdfshell_sh5b51dfb1-1b62-42d0-9543-3d235f71fc8f
Source: unknown	Process created: C:\Users\user\Desktop\fero.exe 'C:\Users\user\Desktop\fero.exe'
Source: unknown	Process created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' --channel=3400.0.2047977454 --type=renderer --shell-broker-channel=broker_pdfshell_sh5b51dfb1-1b62-42d0-9543-3d235f71fc8f /b /id 1480_3105 /if pdfshell_shedd541f9-0a3b-42a7-bd11-13068122ae87
Source: unknown	Process created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' --channel=3384.0.766126944 --type=renderer 'C:\Users\user\Desktop\fire and fury.pdf'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\chrome64x.exe 'C:\Users\user\AppData\Local\Temp\chrome64x.exe'
Source: unknown	Process created: C:\Windows\System32\netsh.exe netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\chrome64x.exe' 'chrome64x.exe' ENABLE
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe 'C:\Users\user\AppData\Local\Temp\chrome64x.exe' ..
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe 'C:\Users\user\AppData\Local\Temp\chrome64x.exe' ..
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f39b6b3505175465947b62295a9a0ae2.exe
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\chrome64x.exe 'C:\Users\user\AppData\Local\Temp\chrome64x.exe'
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\chrome64x.exe 'C:\Users\user\AppData\Local\Temp\chrome64x.exe'
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\fire and fury.pdf'
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process created: C:\Users\user\Desktop\fero.exe 'C:\Users\user\Desktop\fero.exe'
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' --channel=3384.0.766126944 --type=renderer 'C:\Users\user\Desktop\fire and fury.pdf'
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' --channel=3400.0.2047977454 --type=renderer --shell-broker-channel=broker_pdfshell_sh5b51dfb1-1b62-42d0-9543-3d235f71fc8f /b /id 1480_3105 /if pdfshell_shedd541f9-0a3b-42a7-bd11-13068122ae87
Source: C:\Users\user\Desktop\fero.exe	Process created: C:\Users\user\AppData\Local\Temp\chrome64x.exe 'C:\Users\user\AppData\Local\Temp\chrome64x.exe'
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\chrome64x.exe' 'chrome64x.exe' ENABLE
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\chrome64x.exe 'C:\Users\user\AppData\Local\Temp\chrome64x.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\chrome64x.exe 'C:\Users\user\AppData\Local\Temp\chrome64x.exe'

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Show sources

Source: chrome64x.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: f39b6b3505175465947b62295a9a0ae2.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Contains functionality to call native functions

Show sources

Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579E90 NtMapViewOfSection,	5_2_00579E90
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_005799D0 NtCreateKey,	5_2_005799D0
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579890 NtQueryAttributesFile,	5_2_00579890
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579B50 NtOpenSection,	5_2_00579B50
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579AD0 NtCreateMutant,	5_2_00579AD0
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579850 NtOpenFile,	5_2_00579850
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579800 NtCreateFile,	5_2_00579800
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579B10 NtCreateSection,	5_2_00579B10
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579A10 NtOpenKey,	5_2_00579A10
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579A50 NtOpenKeyEx,	5_2_00579A50
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 5_2_00579910 NtSetInformationFile,	5_2_00579910
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177250 NtOpenKeyEx,	6_2_00177250
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_001772D0 NtCreateMutant,	6_2_001772D0
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177350 NtOpenSection,	6_2_00177350
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177110 NtSetInformationFile,	6_2_00177110
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177690 NtMapViewOfSection,	6_2_00177690
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177390 NtDeleteValueKey,	6_2_00177390
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177050 NtOpenFile,	6_2_00177050
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177310 NtCreateSection,	6_2_00177310
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177000 NtCreateFile,	6_2_00177000
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177090 NtQueryAttributesFile,	6_2_00177090
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_001771D0 NtCreateKey,	6_2_001771D0
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Code function: 6_2_00177210 NtOpenKey,	6_2_00177210

Creates files inside the system directory

Show sources

Source: C:\Windows\explorer.exe

File created: C:\Windows\AppPatch\pcamain.sdb

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01387058	1_2_01387058
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01389E79	1_2_01389E79
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_013A3064	1_2_013A3064
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_013931E4	1_2_013931E4
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01384D7F	1_2_01384D7F
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_0139E640	1_2_0139E640
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_013843C7	1_2_013843C7
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01383FAF	1_2_01383FAF
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_0139EAEE	1_2_0139EAEE
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01384948	1_2_01384948
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01394362	1_2_01394362
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01381595	1_2_01381595
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_013936E0	1_2_013936E0
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01393F2D	1_2_01393F2D
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01393AF8	1_2_01393AF8
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_0138929D	1_2_0138929D
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_013970A2	1_2_013970A2

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Code function: String function: 01391430 appears 44 times

PE file contains executable resources (Code or Archives)

Show sources

Source: Xtaqxu6frQ.exe

Static PE information: Resource name: RT_STRING type: ump; Hitachi SH big-endian COFF object, not stripped

Reads the hosts file

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe

File read: C:\Windows\System32\drivers\etc\hosts

Sample file is different than original file name gathered from version info

Show sources

Source: Xtaqxu6frQ.exe	Binary or memory string: OriginalFilenamefero.exe, vs Xtaqxu6frQ.exe
Source: Xtaqxu6frQ.exe	Binary or memory string: OriginalFilenameuser32j% vs Xtaqxu6frQ.exe
Source: Xtaqxu6frQ.exe	Binary or memory string: OriginalFilenameMSCTF.DLL.MUIj% vs Xtaqxu6frQ.exe
Source: Xtaqxu6frQ.exe	Binary or memory string: System.OriginalFileName vs Xtaqxu6frQ.exe
Source: Xtaqxu6frQ.exe	Binary or memory string: originalfilename vs Xtaqxu6frQ.exe
Source: Xtaqxu6frQ.exe	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs Xtaqxu6frQ.exe
Source: Xtaqxu6frQ.exe	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs Xtaqxu6frQ.exe

Sample reads its own file content

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

File read: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Tries to load missing DLLs

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: AcroRd32.exe	Binary or memory string: Progman
Source: AcroRd32.exe	Binary or memory string: Program Manager
Source: AcroRd32.exe	Binary or memory string: Shell_TrayWnd

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\fire and fury.pdf'
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process created: C:\Users\user\Desktop\fero.exe 'C:\Users\user\Desktop\fero.exe'
Source: C:\Users\user\Desktop\fero.exe	Process created: C:\Users\user\AppData\Local\Temp\chrome64x.exe 'C:\Users\user\AppData\Local\Temp\chrome64x.exe'
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\chrome64x.exe' 'chrome64x.exe' ENABLE

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01392035 SetUnhandledExceptionFilter,	1_2_01392035
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01391EA3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_01391EA3
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_0139A2D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0139A2D5
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01392327 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_01392327

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Users\user\Desktop\fero.exe

Memory allocated: page read and write and page guard

Checks for debuggers (devices)

Show sources

Source: C:\Windows\explorer.exe	File opened: C:\Windows\WinSxS\FileMaps\users_user_desktop_081ed9a3f3f73382.cdf-ms
Source: C:\Windows\explorer.exe	File opened: C:\Windows\WinSxS\FileMaps\users_user_appdata_local_temp_c71c0f136cf24ef2.cdf-ms
Source: C:\Windows\explorer.exe	File opened: C:\Windows\WinSxS\FileMaps\program_files_adobe_reader_11.0_reader_1cc3b67bab52e14c.cdf-ms

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\fero.exe

System information queried: KernelDebuggerInformation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Code function: 1_2_01391EA3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_01391EA3

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Code function: 1_2_013991B4 mov eax, dword ptr fs:[00000030h]

1_2_013991B4

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Code function: 1_2_0139D230 GetProcessHeap,

1_2_0139D230

Enables debug privileges

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe

Process token adjusted: Debug

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_0138ECFC SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,SetDlgItemTextW,FindClose,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,SetDlgItemTextW,SetDlgItemTextW,	1_2_0138ECFC
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_0139C562 FindFirstFileExA,	1_2_0139C562
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Code function: 1_2_01382816 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_01382816

Contains functionality to query system information

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Code function: 1_2_01390F5F VirtualQuery,GetSystemInfo,

1_2_01390F5F

Program exit points

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

API call chain: ExitProcess graph end node

graph_1-20380

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe

Window / User API: threadDelayed 10081

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe TID: 3944	Thread sleep count: 10081 > 30
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe TID: 2456	Thread sleep time: -120000s >= -60000s
Source: C:\Windows\explorer.exe TID: 4004	Thread sleep time: -120000s >= -60000s
Source: C:\Windows\explorer.exe TID: 4064	Thread sleep time: -120000s >= -60000s
Source: C:\Windows\explorer.exe TID: 4080	Thread sleep time: -120000s >= -60000s
Source: C:\Windows\explorer.exe TID: 4076	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\explorer.exe TID: 2116	Thread sleep time: -60000s >= -60000s
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe TID: 2408	Thread sleep time: -922337203685477s >= -60000s
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe TID: 2156	Thread sleep time: -922337203685477s >= -60000s

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\fero.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Process information set: NOOPENFILEERRORBOX

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies the internet feature controls of the internet explorer

Show sources

Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe

Registry value created: HKEY_USERS\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

Disables zone checking for all users

Show sources

Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe

Registry value created: HKEY_USERS\Environment SEE_MASK_NOZONECHECKS

Modifies the windows firewall

Show sources

Source: unknown

Process created: C:\Windows\System32\netsh.exe netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\chrome64x.exe' 'chrome64x.exe' ENABLE

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: unknown

Process created: C:\Windows\System32\netsh.exe netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\chrome64x.exe' 'chrome64x.exe' ENABLE

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Code function: 1_2_0139085C OleInitialize,GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,LoadBitmapW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,DeleteObject,CloseHandle,CoUninitialize,

1_2_0139085C

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Code function: 1_2_0138299B GetVersionExW,

1_2_0138299B

Queries the cryptographic machine GUID

Show sources

Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

1_2_0138DB87

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\Xtaqxu6frQ.exe

Code function: 1_2_01385C5C cpuid

1_2_01385C5C

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\Desktop\fero.exe	Queries volume information: C:\Users\user\Desktop\fero.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\chrome64x.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\chrome64x.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\chrome64x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\chrome64x.exe VolumeInformation

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
16:19:25	API Interceptor	912x Sleep call for process: AcroRd32.exe modified from: 60000ms to: 5000ms
16:19:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f39b6b3505175465947b62295a9a0ae2 "C:\Users\user\AppData\Local\Temp\chrome64x.exe" ..
16:19:42	API Interceptor	1x Sleep call for process: netsh.exe modified from: 60000ms to: 5000ms
16:19:42	API Interceptor	14x Sleep call for process: explorer.exe modified from: 60000ms to: 5000ms
16:19:42	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run f39b6b3505175465947b62295a9a0ae2 "C:\Users\user\AppData\Local\Temp\chrome64x.exe" ..
16:19:42	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f39b6b3505175465947b62295a9a0ae2.exe
16:19:46	API Interceptor	8x Sleep call for process: chrome64x.exe modified from: 60000ms to: 5000ms

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Networking:

Boot Survival:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshot